Skip to content

ROADMAP.md

Latest commit

 

History

History
138 lines (108 loc) · 6.45 KB

ROADMAP.md

File metadata and controls

138 lines (108 loc) · 6.45 KB
Raw

Roadmap

The project vision: every AI agent gets a verifiable identity, records evidence for review, and anchors its trust on-chain.

Phase 1 - Identity & Trust (Complete)

MCP tools for cross-protocol agent identity.

Module What it does
Identity Unified Agent Identity Tokens (UAITs) bridging MCP OAuth, A2A Agent Cards, DIDs, and API keys. local data erasure tooling
Agent Cards Parse, generate, and discover Google A2A-compatible agent cards
DID Create and resolve W3C Decentralized Identifiers (did:key, did:web, Universal Resolver)
Delegation UCAN-style capability delegation with EdDSA-signed JWT tokens, revocation
Reputation Recency-weighted trust scoring (0.0-1.0) with category breakdown and 30-day half-life decay

Key decisions:

  • Ed25519 for all cryptographic operations (same as SSH, Signal, Solana, Cosmos)
  • JSON file storage with file locking - no database dependency
  • All records cryptographically signed at creation time
  • Server signing key auto-generated on first run
  • SSRF protection on all URL-fetching operations
  • Hash-chained audit trail with SHA-256 for tamper-evident logging
  • 91 conformance benchmark tests validating RFC 8032, W3C VC, W3C DID, UCAN, and MCP standards

Phase 2 - Governance documentation workflow (implemented)

MCP tools for regulatory compliance documentation.

Module What it does
Compliance Risk categorization (minimal/limited/high), conformity assessments (Article 43), Annex V declarations, profile updates
Credentials W3C Verifiable Credentials (VC Data Model 1.1) with Ed25519Signature2020 proofs, external verification, Verifiable Presentations
Provenance Training data provenance (Article 10), model lineage (Article 11), hash-chained audit trail (Article 12)

Key decisions:

  • VC Data Model 1.1 (widely supported, stable specification)
  • High-risk systems blocked from self-assessment (requires third-party per Article 43)
  • Declaration generation auto-issues a W3C Verifiable Credential
  • Mutable fields excluded from signature payloads (revocation doesn't break signatures)
  • External VP and credential verification for third-party auditors

EU AI Act timeline:

  • 2 August 2026 - general application, with role-specific exceptions; see the current EU timeline
  • 2 December 2027 - Chapter III Sections 1-3 apply to Annex III high-risk systems
  • 2 August 2028 - specified Annex I high-risk systems embedded in regulated products

Phase 3 - Blockchain Anchoring (Complete)

MCP tools for on-chain tamper-evident verification. Everything still works offline - blockchain adds public verifiability.

Module What it does
Blockchain Anchor identity and credential hashes to Base L2 via EAS, Merkle batch anchoring, cost estimation

Tools:

  • anchor_identity - Anchor a UAIT hash on-chain
  • anchor_credential - Anchor a VC hash via EAS
  • anchor_audit_batch - Merkle-root a batch of audit entries
  • verify_anchor - Check on-chain anchor for any artifact
  • get_anchor_status - Retrieve all on-chain anchors for an agent
  • estimate_anchor_cost - Gas estimation before anchoring

Target chain: Base (Ethereum L2) - sub-$0.01 gas costs, EAS support, growing agent ecosystem.

Phase 4 - Ecosystem Bridges (Planned)

Connect to existing agent identity ecosystems for interoperability.

ERC-8004 Identity Registry

  • Adapter between UAIT and ERC-8004 on-chain agent identity (ERC-721 compatible)
  • Mint agent identity NFTs from UAITs
  • Resolve ERC-8004 identities back to UAITs
  • Bi-directional sync: changes on either side reflected

A2A Agent Card Auto-Sync

  • Watch for UAIT changes and auto-update hosted agent.json
  • Reverse sync: discover agent cards and import as UAITs
  • Support for agent card registries

ANS (Agent Name Service)

  • Human-readable agent names (like ENS for agents)
  • Resolve agent.vibetensor.eth to a UAIT
  • Register and manage agent names on-chain

Polygon ID / Zero-Knowledge Credentials

  • Issue ZK-compatible credentials (selective disclosure)
  • Explore selective disclosure of recorded claims (planned)
  • Integration with Polygon ID Verifier SDK

Estimated tools: 8-12

Phase 5 - Multi-Chain & Enterprise (Future)

Multi-Chain Identity

  • Solana (SVM): anchor UAITs on Solana for sub-second finality
  • Cosmos (IBC): cross-chain identity via IBC protocol
  • Polkadot: parachain identity bridging
  • Chain-agnostic resolution: given any on-chain anchor, resolve back to UAIT

Enterprise Features

  • Role-based access control for multi-user Attestix instances
  • PostgreSQL/MongoDB storage backend (replace JSON for scale)
  • REST API server mode (in addition to MCP stdio)
  • Webhook notifications for identity/compliance events
  • Batch operations for fleet management (100s of agents)
  • Audit log export (CSV, SIEM integration)

Global Regulatory Expansion

  • US: NIST AI RMF mapping, Colorado AI Act (SB 24-205), Texas RAIGA
  • India: Digital India Act AI provisions
  • South Korea: AI Basic Act compliance profiles
  • China: Algorithm Registration compliance
  • ISO/IEC 42001 AI Management System mapping
  • Regulatory framework plugin system (add new regulations without code changes)

SDK & Integrations

  • Python SDK (pip install attestix-sdk) with typed client
  • TypeScript/JavaScript SDK for Node.js and browser
  • LangChain native integration (published to langchain-community)
  • CrewAI plugin
  • Official MCP tool catalog listing

Version Plan

Version Phase Target
0.1.0 Phase 1 + 2 Initial release
0.2.0 Phase 3 Blockchain anchoring + security audit + conformance benchmarks (MCP tools, 284 tests)
0.3.0 Phase 3.5 Real LangChain/OpenAI Agents/CrewAI integrations, CI/CD, security hardening (358 tests, 1 skipped on Windows)
0.4.0 Released Canonical packaging and storage/signing interfaces
Unreleased Phase 4 Planned ERC-8004, A2A sync, ANS
0.4.1 Released Optional post-quantum signing and security hardening
Unreleased Phase 4 follow-up Planned Polygon ID / ZK credentials
0.5.0 Phase 5 Multi-chain + enterprise storage
1.0.0 Stable Production-ready with full test suite and third-party audit

See the European Commission's current AI Act timeline and Regulation (EU) 2026/1744. Applicability depends on the system and operator role.